[rfc] crun extension compatibility

We've had a fair few requests from folks about the run.oci.* extensions and why runc doesn't support them. Given that some of these extensions are likely not going to be put into the runtime-spec (run.oci.keep_original_groups was suggested some time ago in opencontainers/runtime-spec#1020 but the core feature is basically a security anti-feature).

The two main features I see requests for quite often are:

• run.oci.keep_original_groups which lets you disable the setgroups step when using rootless containers with newgidmap. This lets the container access host groups (which is usually a security issue) which then allows you to access the GPU if the original user had access to the video group. podman has a magic flag to let you use this, but obviously it only works with crun at the moment since it's controlled by a non-standard annotation (benefits of vertical integration, I guess you could say).

• run.oci.handler is a generic mechanism for crun to run non-standard container workloads rather than doing a straight-forward exec of a binary. In particular run.oci.handler=wasm causes crun to run WASM code in the context of the pid1 through various WASM runtimes directly (crun can be compiled with wasm support, where a wasm runtime library is linked into crun and then crun runs the runtime on the target .wasm or .w. I'm a little worried that it seems that nobody can agree on what WASM runtime should be used (and crun itself supports four different runtimes AFAICS) but we could do something minimal with https://github.com/tetratelabs/wazero to see how many users want this feature.

Though there are probably others.

What should the policy be for supporting these? My view is that if users need these features we should support them even if they're non-standard because the alternative is that folks switch to crun. (One obvious point of confusion is that crun has called the annotations run.oci.* which users might think means they are official OCI annotations -- obviously only org.opencontainers.* annotations are official but that doesn't really help with public perception.)

Start by reviewing the two proposed extensions in the issue: run.oci.keep_original_groups and run.oci.handler, along with runtime-spec#1020 and the referenced wazero option. Compare the requested behavior with runc's current OCI annotation and runtime entry points. Done means an agreed policy and a defined implementation scope, since this RFC does not identify files or tests.